From 92df9588f2e2ccd96f86c9b2f89e31d516984841 Mon Sep 17 00:00:00 2001 From: Josh Drake Date: Thu, 15 Oct 2026 15:46:22 -0500 Subject: [PATCH 1/2] Add the dns-persist-01 ACME challenge type Add DNS_PERSIST_01 to ACMEProvisioner.ChallengeType, and the account_hash_prefix and issuer_domain_names fields that configure it. These map to the accountHashPrefix and issuerDomainNames properties of the step-ca ACME provisioner, as defined in draft-ietf-acme-dns-persist-02. --- provisioners.pb.go | 31 +++++++++++++++++++++++++++---- spec/linkedca/provisioners.proto | 3 +++ 2 files changed, 30 insertions(+), 4 deletions(-) diff --git a/provisioners.pb.go b/provisioners.pb.go index e4349f4..6dec8f5 100644 --- a/provisioners.pb.go +++ b/provisioners.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: // protoc-gen-go v1.36.11 -// protoc v7.35.1 +// protoc v7.36.1 // source: linkedca/provisioners.proto package linkedca @@ -106,6 +106,7 @@ const ( ACMEProvisioner_DNS_01 ACMEProvisioner_ChallengeType = 2 ACMEProvisioner_TLS_ALPN_01 ACMEProvisioner_ChallengeType = 3 ACMEProvisioner_DEVICE_ATTEST_01 ACMEProvisioner_ChallengeType = 4 + ACMEProvisioner_DNS_PERSIST_01 ACMEProvisioner_ChallengeType = 5 ) // Enum value maps for ACMEProvisioner_ChallengeType. @@ -116,6 +117,7 @@ var ( 2: "DNS_01", 3: "TLS_ALPN_01", 4: "DEVICE_ATTEST_01", + 5: "DNS_PERSIST_01", } ACMEProvisioner_ChallengeType_value = map[string]int32{ "UNKNOWN": 0, @@ -123,6 +125,7 @@ var ( "DNS_01": 2, "TLS_ALPN_01": 3, "DEVICE_ATTEST_01": 4, + "DNS_PERSIST_01": 5, } ) @@ -1512,6 +1515,8 @@ type ACMEProvisioner struct { TermsOfService string `protobuf:"bytes,6,opt,name=terms_of_service,json=termsOfService,proto3" json:"terms_of_service,omitempty"` Website string `protobuf:"bytes,7,opt,name=website,proto3" json:"website,omitempty"` CaaIdentities []string `protobuf:"bytes,8,rep,name=caa_identities,json=caaIdentities,proto3" json:"caa_identities,omitempty"` + AccountHashPrefix string `protobuf:"bytes,9,opt,name=account_hash_prefix,json=accountHashPrefix,proto3" json:"account_hash_prefix,omitempty"` + IssuerDomainNames []string `protobuf:"bytes,10,rep,name=issuer_domain_names,json=issuerDomainNames,proto3" json:"issuer_domain_names,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } @@ -1602,6 +1607,20 @@ func (x *ACMEProvisioner) GetCaaIdentities() []string { return nil } +func (x *ACMEProvisioner) GetAccountHashPrefix() string { + if x != nil { + return x.AccountHashPrefix + } + return "" +} + +func (x *ACMEProvisioner) GetIssuerDomainNames() []string { + if x != nil { + return x.IssuerDomainNames + } + return nil +} + type X5CProvisioner struct { state protoimpl.MessageState `protogen:"open.v1"` Roots [][]byte `protobuf:"bytes,1,rep,name=roots,proto3" json:"roots,omitempty"` @@ -2291,7 +2310,7 @@ const file_linkedca_provisioners_proto_rawDesc = "" + "\x1adisable_trust_on_first_use\x18\x05 \x01(\bR\x16disableTrustOnFirstUse\x12)\n" + "\x10subscription_ids\x18\x06 \x03(\tR\x0fsubscriptionIds\x12\x1d\n" + "\n" + - "object_ids\x18\a \x03(\tR\tobjectIds\"\xc0\x04\n" + + "object_ids\x18\a \x03(\tR\tobjectIds\"\xb4\x05\n" + "\x0fACMEProvisioner\x12\x19\n" + "\bforce_cn\x18\x01 \x01(\bR\aforceCn\x12\x1f\n" + "\vrequire_eab\x18\x02 \x01(\bR\n" + @@ -2303,14 +2322,18 @@ const file_linkedca_provisioners_proto_rawDesc = "" + "\x11attestation_roots\x18\x05 \x03(\fR\x10attestationRoots\x12(\n" + "\x10terms_of_service\x18\x06 \x01(\tR\x0etermsOfService\x12\x18\n" + "\awebsite\x18\a \x01(\tR\awebsite\x12%\n" + - "\x0ecaa_identities\x18\b \x03(\tR\rcaaIdentities\"\\\n" + + "\x0ecaa_identities\x18\b \x03(\tR\rcaaIdentities\x12.\n" + + "\x13account_hash_prefix\x18\t \x01(\tR\x11accountHashPrefix\x12.\n" + + "\x13issuer_domain_names\x18\n" + + " \x03(\tR\x11issuerDomainNames\"p\n" + "\rChallengeType\x12\v\n" + "\aUNKNOWN\x10\x00\x12\v\n" + "\aHTTP_01\x10\x01\x12\n" + "\n" + "\x06DNS_01\x10\x02\x12\x0f\n" + "\vTLS_ALPN_01\x10\x03\x12\x14\n" + - "\x10DEVICE_ATTEST_01\x10\x04\"P\n" + + "\x10DEVICE_ATTEST_01\x10\x04\x12\x12\n" + + "\x0eDNS_PERSIST_01\x10\x05\"P\n" + "\x15AttestationFormatType\x12\b\n" + "\x04NONE\x10\x00\x12\t\n" + "\x05APPLE\x10\x01\x12\b\n" + diff --git a/spec/linkedca/provisioners.proto b/spec/linkedca/provisioners.proto index 363fe01..5dab0f8 100644 --- a/spec/linkedca/provisioners.proto +++ b/spec/linkedca/provisioners.proto @@ -146,6 +146,7 @@ message ACMEProvisioner { DNS_01 = 2; TLS_ALPN_01 = 3; DEVICE_ATTEST_01 = 4; + DNS_PERSIST_01 = 5; } enum AttestationFormatType { NONE = 0; @@ -162,6 +163,8 @@ message ACMEProvisioner { string terms_of_service = 6; string website = 7; repeated string caa_identities = 8; + string account_hash_prefix = 9; + repeated string issuer_domain_names = 10; } message X5CProvisioner { From 461579ba19c9161b522fb94c54a2b536cd28c935 Mon Sep 17 00:00:00 2001 From: Josh Drake Date: Thu, 15 Oct 2026 17:11:08 -0500 Subject: [PATCH 2/2] Bump golang.org/x/net to v0.61.0 Fixes GO-2026-6603, GO-2026-6611, GO-2026-6612 and GO-2026-6617, which govulncheck reports in golang.org/x/net v0.58.0. --- go.mod | 16 ++++++++-------- go.sum | 32 ++++++++++++++++---------------- 2 files changed, 24 insertions(+), 24 deletions(-) diff --git a/go.mod b/go.mod index 97dcdf4..7350bed 100644 --- a/go.mod +++ b/go.mod @@ -205,14 +205,14 @@ require ( go.uber.org/zap v1.27.0 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect golang.org/x/exp/typeparams v0.0.0-20250911091902-df9299821621 // indirect - golang.org/x/mod v0.38.0 // indirect - golang.org/x/net v0.58.0 // indirect - golang.org/x/sync v0.22.0 // indirect - golang.org/x/sys v0.47.0 // indirect - golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 // indirect - golang.org/x/term v0.45.0 // indirect - golang.org/x/text v0.41.0 // indirect - golang.org/x/tools v0.48.0 // indirect + golang.org/x/mod v0.41.0 // indirect + golang.org/x/net v0.61.0 // indirect + golang.org/x/sync v0.24.0 // indirect + golang.org/x/sys v0.49.0 // indirect + golang.org/x/telemetry v0.0.0-20260924152758-ed294f943157 // indirect + golang.org/x/term v0.47.0 // indirect + golang.org/x/text v0.43.0 // indirect + golang.org/x/tools v0.51.0 // indirect golang.org/x/vuln v1.1.4 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect gopkg.in/ini.v1 v1.67.0 // indirect diff --git a/go.sum b/go.sum index be8cb71..0a7b7d9 100644 --- a/go.sum +++ b/go.sum @@ -694,8 +694,8 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= -golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= -golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -734,8 +734,8 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= +golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -757,8 +757,8 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= -golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= -golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= +golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -809,18 +809,18 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 h1:RJhm5l6Fo4rmEIcndxDllNhhf/fAx8qIm4t6A7vpm2A= -golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959/go.mod h1:LV7u5Oco+Z/g6XI7PqN+EUUUGGkEcmB1uj2ceI0fOVg= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/telemetry v0.0.0-20260924152758-ed294f943157 h1:DftxASHKl6JolFPqoN+2WrFO53JvkHwRXvFqf8gsivA= +golang.org/x/telemetry v0.0.0-20260924152758-ed294f943157/go.mod h1:i+ivNqjDnTF3WTElsdk5g9V5DTSBYgdNo7xTU9SDwYA= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U= -golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= -golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= +golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -831,8 +831,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= -golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= -golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= +golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -886,8 +886,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg= -golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= -golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= +golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI= +golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA= golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM= golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY= golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=